{
  "Name": "Splashtop",
  "Category": "RMM",
  "Description": "Splashtop is a remote monitoring and management (RMM) tool. More information will be added as it becomes available.",
  "Author": "Nasreddine Bencherchali",
  "Created": "2024-08-02",
  "LastModified": "2024-08-02",
  "Details": {
    "Website": "https://www.splashtop.com/",
    "PEMetadata": {
      "Filename": "",
      "OriginalFileName": "",
      "Description": ""
    },
    "Privileges": "",
    "Free": "",
    "Verification": "",
    "SupportedOS": [],
    "Capabilities": [],
    "Vulnerabilities": [],
    "InstallationPaths": [
      "C:\\Program Files (x86)\\Splashtop\\*",
      "*\\Splashtop\\Splashtop Remote\\Client for RMM\\*",
      "strwinclt.exe"
    ]
  },
  "Artifacts": {
    "Disk": [
      {
        "File": "C:\\windows\\System32\\winevt\\Logs\\Splashtop-Splashtop Streamer-Status%4Operational.evtx",
        "Description": "N/A",
        "OS": "Windows"
      },
      {
        "File": "C:\\windows\\System32\\winevt\\Logs\\Splashtop-Splashtop Streamer-Remote Session%4Operational.evtx",
        "Description": "N/A",
        "OS": "Windows"
      },
      {
        "File": "%PROGRAMDATA%\\Splashtop\\Temp\\log\\FTCLog.txt",
        "Description": "N/A",
        "OS": "Windows"
      },
      {
        "File": "C:\\Program Files (x86)\\Splashtop\\Splashtop Remote\\Server\\log\\agent_log.txt",
        "Description": "N/A",
        "OS": "Windows"
      },
      {
        "File": "C:\\Program Files (x86)\\Splashtop\\Splashtop Remote\\Server\\log\\SPLog.txt",
        "Description": "N/A",
        "OS": "Windows"
      },
      {
        "File": "C:\\Program Files (x86)\\Splashtop\\Splashtop Remote\\Server\\log\\svcinfo.txt",
        "Description": "N/A",
        "OS": "Windows"
      },
      {
        "File": "C:\\Program Files (x86)\\Splashtop\\Splashtop Remote\\Server\\log\\sysinfo.txt",
        "Description": "N/A",
        "OS": "Windows"
      },
      {
        "File": "C:\\Program Files (x86)\\Splashtop\\Splashtop Remote\\Server\\SRService.exe",
        "Description": "Splashtop Remote Service",
        "OS": "Windows"
      },
      {
        "File": "C:\\Program Files (x86)\\Splashtop\\Splashtop Remote\\Server\\SRAgent.exe",
        "Description": "SplashTop Remote Agent",
        "OS": "Windows"
      },
      {
        "File": "C:\\Program Files (x86)\\Splashtop\\Splashtop Software Updater\\SSUAgent.exe",
        "Description": "Splashtop Updater",
        "OS": "Windows"
      },
      {
        "File": "C:\\Program Files (x86)\\Splashtop\\Splashtop Remote\\Server\\SRUtility.exe",
        "Description": "N/A",
        "OS": "Windows"
      },
      {
        "File": "C:\\Program Files (x86)\\Splashtop\\Splashtop Remote\\Server\\SRFeature.exe",
        "Description": "N/A",
        "OS": "Windows"
      },
      {
        "File": "C:\\Program Files (x86)\\Splashtop\\Splashtop Remote\\Server\\db\\SRAgent.sqlite3",
        "Description": "N/A",
        "OS": "Windows"
      }
    ],
    "EventLog": [
      {
        "EventID": 7045,
        "ProviderName": "Service Control Manager",
        "LogFile": "System.evtx",
        "ServiceName": "Splashtop Software Updater Service",
        "ImagePath": "\"C:\\\\Program Files (x86)\\\\Splashtop\\\\Splashtop Software Updater\\\\SSUService.exe\"",
        "Description": "Service installation event as result of Splashtop Software Updater Service installation."
      },
      {
        "EventID": 7045,
        "ProviderName": "Service Control Manager",
        "LogFile": "System.evtx",
        "ServiceName": "Splashtop® Remote Service",
        "ImagePath": "\"C:\\\\Program Files (x86)\\\\Splashtop\\\\Splashtop Remote\\\\Server\\\\SRService.exe\"",
        "Description": "Service installation event as result of Splashtop Remote Service installation."
      },
      {
        "EventID": 7045,
        "ProviderName": "Service Control Manager",
        "LogFile": "System.evtx",
        "ServiceName": "SplashtopRemoteService",
        "ImagePath": "\"C:\\\\Program Files (x86)\\\\Splashtop\\\\Splashtop Remote\\\\Server\\\\SRService.exe\"",
        "Description": "Service installation event as result of Splashtop Remote Service installation."
      }
    ],
    "Registry": [
      {
        "Path": "KLM\\SOFTWARE\\WOW6432Node\\Splashtop Inc.\\*",
        "Description": "Splashtop Inc. registry key"
      },
      {
        "Path": "HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Splashtop Software Updater",
        "Description": "Splashtop Software Updater uninstall key"
      },
      {
        "Path": "HKLM\\SYSTEM\\CurrentControlSet\\Services\\SplashtopRemoteService",
        "Description": "Splashtop Remote Service registry key"
      },
      {
        "Path": "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\Splashtop-Splashtop Streamer-Remote Session/Operational",
        "Description": "Splashtop Streamer Remote Session event log channel"
      },
      {
        "Path": "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\Splashtop-Splashtop Streamer-Status/Operational",
        "Description": "Splashtop Streamer Status event log channel"
      },
      {
        "Path": "HKLM\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Splashtop Software Updater\\InstallRefCount",
        "Description": "Splashtop Software Updater install reference count"
      },
      {
        "Path": "HKLM\\SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Network\\SplashtopRemoteService",
        "Description": "Splashtop Remote Service safe boot configuration"
      },
      {
        "Path": "HKU\\.DEFAULT\\Software\\Splashtop Inc.\\*",
        "Description": "Default user Splashtop Inc. registry key"
      },
      {
        "Path": "HKU\\SID\\Software\\Splashtop Inc.\\*",
        "Description": "User-specific Splashtop Inc. registry key"
      },
      {
        "Path": "HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\Printers\\Splashtop PDF Remote Printer",
        "Description": "Splashtop PDF Remote Printer configuration"
      },
      {
        "Path": "HKLM\\SOFTWARE\\WOW6432Node\\Splashtop Inc.\\Splashtop Remote Server\\ClientInfo\\*",
        "Description": "Splashtop Remote Server client information"
      }
    ],
    "Network": [
      {
        "Description": "N/A",
        "Domains": [
          "*.splashtop.com"
        ],
        "Ports": []
      }
    ]
  },
  "Detections": [
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/splashtop_registry_sigma.yml",
      "Description": "Detects potential registry activity of Splashtop RMM tool"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/splashtop_network_sigma.yml",
      "Description": "Detects potential network activity of Splashtop RMM tool"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/splashtop_files_sigma.yml",
      "Description": "Detects potential files activity of Splashtop RMM tool"
    },
    {
      "Sigma": "https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/splashtop_processes_sigma.yml",
      "Description": "Detects potential processes activity of Splashtop RMM tool"
    }
  ],
  "References": [
    "https://www.synacktiv.com/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects.html"
  ],
  "Acknowledgement": [
    {
      "Person": "Théo Letailleur",
      "Handle": "in/theosyn"
    }
  ],
  "CodeSigning": {
    "certificates": [
      {
        "signer_name": "Splashtop Inc.",
        "certificate_thumbprint": "D458B32F6946DBB682A9687076EB9209979BDF76",
        "certificate_der_base64": "MIIHwTCCBamgAwIBAgIQBtI6cGq4XDJJCDeVS55BozANBgkqhkiG9w0BAQsFADBpMQswCQYDVQQGEwJVUzEXMBUGA1UEChMORGlnaUNlcnQsIEluYy4xQTA/BgNVBAMTOERpZ2lDZXJ0IFRydXN0ZWQgRzQgQ29kZSBTaWduaW5nIFJTQTQwOTYgU0hBMzg0IDIwMjEgQ0ExMB4XDTI1MDUyMDAwMDAwMFoXDTI4MDUxOTIzNTk1OVowgckxEzARBgsrBgEEAYI3PAIBAxMCVVMxGTAXBgsrBgEEAYI3PAIBAhMIRGVsYXdhcmUxHTAbBgNVBA8MFFByaXZhdGUgT3JnYW5pemF0aW9uMRAwDgYDVQQFEwc0MTY5ODgxMQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTESMBAGA1UEBxMJQ3VwZXJ0aW5vMRcwFQYDVQQKEw5TcGxhc2h0b3AgSW5jLjEXMBUGA1UEAxMOU3BsYXNodG9wIEluYy4wggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCtgy9O1cjrcAJs1It6xVS2qq2ngTEhYZWBhjn7SbqUGw6Zs5oKbOkAHiXlAvPGx0XYT9L+ixlXrGRMpSpsbpRVW0vX8N6sT9lvLjSYVvC4z0knVgCeAQH03KJu4KsCBarNBFYrJYWbfDQq5moFbAxvOWRawNCvPzo2FXq4ffUkd24It4V6yo32pyuqOSAY8PijQpe7gE006bdnutelYGMwaWptSKObp6j8cxZF5g87yT4JoIKVBIs7f4TcoaoYHS5+z5hFMtwn+TjFXG2En2tDoEPIVNwHLFJl4eeaJ3+koCV80MWwQ/QFPmrkcE2yBXpsqMd2iSHemwEoYTINKujXejceqs68OKxRNNJauWyiYFB6f/DbgJmFiskTrTd3UPQvyVQ5Rnvk1EDK0EM3YYALSHl8YWnw7kZqn3vHrPZM2qWRzPvIjaNZ/l8NmBwVJf2ELgs1c19cnYbXk5wN0WZSe02tQiXnfA16Ah47Z2O76RR7xuUf2LFMZFa8JImqpgkTqnvIpTUNHibxNMMXwSesIUgRT2Qh8YWhzJbAvRKkXBGiCqptNBdRiIQFp0pro3h1CGe1gdagFQrgeTQlk14rRqETAvxm+TLMlALSeY8bdd7cEr93RUDrwlGKNO+BumTgTnI0nVjXAiQWk/cA9c+cXh7EmjOgaAvao9xOMZfXkwIDAQABo4ICAjCCAf4wHwYDVR0jBBgwFoAUaDfg67Y7+F8Rhvv+YXsIiGX0TkIwHQYDVR0OBBYEFPeCRV/b/V8X0ZEKBcemOR/1zhonMD0GA1UdIAQ2MDQwMgYFZ4EMAQMwKTAnBggrBgEFBQcCARYbaHR0cDovL3d3dy5kaWdpY2VydC5jb20vQ1BTMA4GA1UdDwEB/wQEAwIHgDATBgNVHSUEDDAKBggrBgEFBQcDAzCBtQYDVR0fBIGtMIGqMFOgUaBPhk1odHRwOi8vY3JsMy5kaWdpY2VydC5jb20vRGlnaUNlcnRUcnVzdGVkRzRDb2RlU2lnbmluZ1JTQTQwOTZTSEEzODQyMDIxQ0ExLmNybDBToFGgT4ZNaHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0VHJ1c3RlZEc0Q29kZVNpZ25pbmdSU0E0MDk2U0hBMzg0MjAyMUNBMS5jcmwwgZQGCCsGAQUFBwEBBIGHMIGEMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wXAYIKwYBBQUHMAKGUGh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFRydXN0ZWRHNENvZGVTaWduaW5nUlNBNDA5NlNIQTM4NDIwMjFDQTEuY3J0MAkGA1UdEwQCMAAwDQYJKoZIhvcNAQELBQADggIBAKL9tbtCq5etewkHZ7JpC53EU8xYEUCQt+igKQVaTaE4A/gfPaDi+cPRfMMtFv7PU5l3XPHB41JZSI3i/GFcF1DIEarWUl5S0OQO69Ni6vhfcL7eO28ZW3PHouAotB/jOkDICvkCjgqU1b1Dmxd1LMT9U0ZkHqSOvunefkjcaoraKNqzjktcJhFMA6vfXFzuMcScX+6jmMgacFkm5ZyWQ3REVKYraJzGrSacI9molf+8dRxA9pm9ePaCIUhXW8u3H9/iAhfhOBCvCOmPkGXP5CsQSx7RferaKhLR9gMaemuMBqW7LdXO9LUVGdEAiPTW+0LRp3aPj9gSPoYl562AQVjJHOSZMmKbuq0qiPsyj4voBq2lv4jveFSCzkg/0SSXNqIvMAHI/k2+71FeRo/6QHeu4saFQ45JzA+ripJNP6a0qieyUboFMxskD9vBKT/sZpFms150Fo31LxMF5s3yYKjUWY5rwlrSdpNGNl6lgm18WbPwrIx7ByoZJudhmoL5j1hldOIu2QCpGkHfdDjrXlFuTccAxXlW2v8GuWy4SDBT9waSy51s27QioAAnnRhiO0z/SaSxaWaAt0PkHLW4fopJTpmwGcLwI2dyYdIPrQ3E4dwMTPEHPPzr+dG5nzbG54aB1KKR4FQXxf1EyrjFxGEA8Ntxf/k4ThFmRFfTNJC+",
        "src_file_sha256": "31333b18ca5cf8f09bc6a8464b34b17f415afee14b6eed877f48ebb7a7191d57",
        "src_file_path": "downloaded_files/splashtop/31333b18ca5cf8f09bc6a8464b34b17f415afee14b6eed877f48ebb7a7191d57",
        "src_file_company": "Splashtop Inc."
      }
    ]
  }
}